Multi-protocol / multi-session process identification

A system comprising:

• one or more computers each including a processor and a memory, wherein the one or more computers are operable to execute instructions which cause the system to perform operations including:
• obtaining, at a device, one or more packets of an encrypted QUIC traffic session in a network;
• determining, by the device, a plurality of application-specific flows multiplexed within the encrypted QUIC traffic session;
• associating a plurality of packets within the encrypted QUIC traffic session with a first application-specific flow of the plurality of application-specific flows by applying a machine learning classifier one or more packets from the encrypted QUIC traffic session.